<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>OpenSSH Server</title>
<link rel="stylesheet" type="text/css" href="../C.css">
<script type="text/javascript" src="../jquery.js"></script><script type="text/javascript" src="../jquery.syntax.js"></script><script type="text/javascript" src="../yelp.js"></script>
</head>
<body id="home">
<!--<script src="https://ssl.google-analytics.com/urchin.js" type="text/javascript"></script><script type="text/javascript">
        _uacct = "UA-1018242-8";
        urchinTracker();
      </script><script>
      function englishPageVersion() {
        var href = window.location.href;
        if (href.slice(-1) == "/") {
                window.location = "index.html.en";
        } else {
                window.location = href.replace(/\.html.*/, ".html.en");
        }
         return false;
      }
      function browserPreferredLanguage() {
        var href = window.location.href;
        if (href.slice(-1) == "/") {
                window.location = href;
        } else {
                window.location = href.replace(/\.html.*/, ".html");
        }
        return false;
      }
      </script>--><div id="container">
<div id="container-inner">
<div id="mothership"><ul>
<li><a href="https://partners.ubuntu.com">Partners</a></li>
<li><a href="https://www.ubuntu.com/support/community-support">Support</a></li>
<li><a href="https://community.ubuntu.com">Community</a></li>
<li><a href="https://www.ubuntu.com">Ubuntu.com</a></li>
</ul></div>
<div id="header">
<h1 id="ubuntu-header"><a href="https://help.ubuntu.com/">Ubuntu Documentation</a></h1>
<ul id="main-menu">
<li><a class="main-menu-item current" href="https://help.ubuntu.com/">Official Documentation</a></li>
<li><a href="https://help.ubuntu.com/community/CommunityHelpWiki">Community Help Wiki</a></li>
<li><a href="https://community.ubuntu.com/t/contribute/26">Contribute</a></li>
</ul>
</div>
<div id="menu-search"><div id="search-box">
<noscript><form action="https://www.google.com/cse" id="cse-search-box"><div>
<input type="hidden" name="cx" value="003883529982892832976:e2vwumte3fq"><input type="hidden" name="ie" value="UTF-8"><input type="text" name="q" size="21"><input type="submit" name="sa" value="Search">
</div></form></noscript><!--
<script>
                document.write('<form action="https://help.ubuntu.com/search.html" id="cse-search-box">');
                document.write('  <div>');
                document.write('    <input type="hidden" name="cof" value="FORID:9">');
                document.write('    <input type="hidden" name="cx" value="003883529982892832976:e2vwumte3fq">');
                document.write('    <input type="hidden" name="ie" value="UTF-8">');
                document.write('    <input type="text" name="q" size="21">');
                document.write('    <input type="submit" name="sa" value="Search">');
                document.write('  </div>');
                document.write('</form>');
              </script>-->
</div></div>
<div class="trails"><div class="trail">
<a href="https://help.ubuntu.com/18.04" class="trail">Ubuntu 18.04</a> » <a class="trail" href="../index.html" title="Ubuntu Server Guide">Ubuntu Server Guide</a> » <a class="trail" href="remote-administration.html" title="Remote Administration">Remote Administration</a> » </div></div>
<div id="cwt-content" class="clearfix content-area"><div id="page">
<div id="content">
<div class="links nextlinks">
<a class="nextlinks-prev" href="remote-administration.html" title="Remote Administration">Previous</a><a class="nextlinks-next" href="puppet.html" title="Puppet">Next</a>
</div>
<div class="hgroup"><h1 class="title">OpenSSH Server</h1></div>
<div class="region">
<div class="contents"></div>
<div class="links sectionlinks" role="navigation"><ul>
<li class="links"><a class="xref" href="openssh-server.html#openssh-introduction" title="Introduction">Introduction</a></li>
<li class="links"><a class="xref" href="openssh-server.html#openssh-installation" title="Installation">Installation</a></li>
<li class="links"><a class="xref" href="openssh-server.html#openssh-configuration" title="Configuration">Configuration</a></li>
<li class="links"><a class="xref" href="openssh-server.html#openssh-keys" title="SSH Keys">SSH Keys</a></li>
<li class="links"><a class="xref" href="openssh-server.html#openssh-references" title="References">References</a></li>
</ul></div>
<div class="sect2 sect" id="openssh-introduction"><div class="inner">
<div class="hgroup"><h2 class="title">Introduction</h2></div>
<div class="region"><div class="contents">
<p class="para">
            This section of the Ubuntu Server Guide introduces a powerful collection of tools
            for the remote control of, and transfer of data between, networked computers called <span class="em emphasis">OpenSSH</span>. You will also learn
            about some of the configuration settings possible with the OpenSSH server application and how to change them on your Ubuntu system.
          </p>
<p class="para">
            OpenSSH is a freely available version of the Secure Shell (SSH) protocol family of
            tools for remotely controlling, or transferring files between, computers.
            Traditional tools used to accomplish these functions, such as
	    <span class="app application">telnet</span> or <span class="app application">rcp</span>, are insecure
	    and transmit the user's password in cleartext when used. OpenSSH provides a server
	    daemon and client tools to facilitate secure, encrypted remote control and file
	    transfer operations, effectively replacing the legacy tools.
          </p>
<p class="para">
            The OpenSSH server component, <span class="app application">sshd</span>, listens
	    continuously for client connections from any of the client tools. When a connection
	    request occurs, <span class="app application">sshd</span> sets up the correct connection
	    depending on the type of client tool connecting. For example, if the remote
	    computer is connecting with the <span class="app application">ssh</span> client application,
	    the OpenSSH server sets up a remote control session after authentication. If a
	    remote user connects to an OpenSSH server with <span class="app application">scp</span>, the
	    OpenSSH server daemon initiates a secure copy of files between the server and
	    client after authentication. OpenSSH can use many authentication methods, including             plain password, public key, and <span class="app application">Kerberos</span> tickets.
            </p>
</div></div>
</div></div>
<div class="sect2 sect" id="openssh-installation"><div class="inner">
<div class="hgroup"><h2 class="title">Installation</h2></div>
<div class="region"><div class="contents">
<p class="para">
        Installation of the OpenSSH client and server applications is simple. To install the
	OpenSSH client applications on your Ubuntu system, use this command at a terminal
	prompt:
        </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo apt install openssh-client</span>
</pre></div>
<p class="para">
        To install the OpenSSH server application, and related support files, use this command
	at a terminal prompt:
        </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo apt install openssh-server</span>
</pre></div>
<p class="para">
	The <span class="app application">openssh-server</span> package can also be selected to
	install during the Server Edition installation process.
	</p>
</div></div>
</div></div>
<div class="sect2 sect" id="openssh-configuration"><div class="inner">
<div class="hgroup"><h2 class="title">Configuration</h2></div>
<div class="region"><div class="contents">
<p class="para">
          You may configure the default behavior of the OpenSSH server application,
	  <span class="app application">sshd</span>, by editing the file
	  <span class="file filename">/etc/ssh/sshd_config</span>. For information about the configuration
	  directives used in this file, you may view the appropriate manual page with the
	  following command, issued at a terminal prompt:
          </p>
<div class="screen"><pre class="contents "><span class="cmd command">man sshd_config</span>
</pre></div>
<p class="para">
            There are many directives in the <span class="app application">sshd</span> configuration
	    file controlling such things as communication settings, and authentication modes.
	    The following are examples of configuration directives that can be changed by
	    editing the <span class="file filename">/etc/ssh/sshd_config</span> file.
            </p>
<div class="note note-tip" title="Tip"><div class="inner"><div class="region"><div class="contents">
                <p class="para">Prior to editing the configuration file, you should make a copy of the
		original file and protect it from writing so you will have the original
		settings as a reference and to reuse as necessary.
                </p>
                <p class="para">Copy the <span class="file filename">/etc/ssh/sshd_config</span> file and protect it
		from writing with the following commands, issued at a terminal prompt:
                </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.original</span>
<span class="cmd command">sudo chmod a-w /etc/ssh/sshd_config.original</span>
</pre></div>
	    </div></div></div></div>
<p class="para">
            The following are examples of configuration directives you may change:
            </p>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
               <p class="para">
               To set your OpenSSH to listen on TCP port 2222 instead of the default TCP port
	       22, change the Port directive as such:
               </p>
               <p class="para">
               Port 2222
               </p>
               </li>
<li class="list itemizedlist">
            <p class="para">
            To have <span class="app application">sshd</span> allow public key-based login credentials,
	    simply add or modify the line:
            </p>
               <p class="para">
               PubkeyAuthentication yes
               </p>
            <p class="para">
            If the line is already present, then ensure it is not commented out.
            </p>
            </li>
<li class="list itemizedlist">
             <p class="para">
             To make your OpenSSH server display the contents of the
	     <span class="file filename">/etc/issue.net</span> file as a pre-login
             banner, simply add or modify the line:
             </p>
               <p class="para">
               Banner  /etc/issue.net
               </p>
               <p class="para">
               In the <span class="file filename">/etc/ssh/sshd_config</span> file.
               </p>
             </li>
</ul></div>
<p class="para">
            After making changes to the <span class="file filename">/etc/ssh/sshd_config</span> file, save
	    the file, and restart the <span class="app application">sshd</span> server application to
	    effect the changes using the following command at a terminal prompt:
            </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo systemctl restart sshd.service</span>
</pre></div>
<div class="note note-warning" title="Warning"><div class="inner"><div class="region"><div class="contents">
                  <p class="para">
                  Many other configuration directives for <span class="app application">sshd</span> are
	          available to change the server application's behavior to fit your needs.
		  Be advised, however, if your only method of access to a server is
		  <span class="app application">ssh</span>, and you make a mistake in configuring
		  <span class="app application">sshd</span> via the
		  <span class="file filename">/etc/ssh/sshd_config</span> file, you may find you
                  are locked out of the server upon restarting it. Additionally, if an incorrect configuration directive is supplied,
        	  the <span class="app application">sshd</span> server may refuse to start, so be extra careful when editing this file on a
		  remote server.
                  </p>
                </div></div></div></div>
</div></div>
</div></div>
<div class="sect2 sect" id="openssh-keys"><div class="inner">
<div class="hgroup"><h2 class="title">SSH Keys</h2></div>
<div class="region"><div class="contents">
<p class="para">
     SSH <span class="em emphasis">keys</span> allow authentication between two hosts without the need of a password.  SSH key authentication
     uses two keys, a <span class="em emphasis">private</span> key and a <span class="em emphasis">public</span> key.
     </p>
<p class="para">
     To generate the keys, from a terminal prompt enter:
     </p>
<div class="screen"><pre class="contents "><span class="cmd command">ssh-keygen -t rsa</span>
</pre></div>
<p class="para">
     This will generate the keys using the <span class="em emphasis">RSA Algorithm</span>.  During the process you
     will be prompted for a password.  Simply hit <span class="em emphasis">Enter</span> when prompted to create the key.
     </p>
<p class="para">
     By default the <span class="em emphasis">public</span> key is saved in the file <span class="file filename">~/.ssh/id_rsa.pub</span>, while
     <span class="file filename">~/.ssh/id_rsa</span> is the <span class="em emphasis">private</span> key.  Now copy the <span class="file filename">id_rsa.pub</span> file
     to the remote host and append it to <span class="file filename">~/.ssh/authorized_keys</span> by entering:
     </p>
<div class="screen"><pre class="contents "><span class="cmd command">ssh-copy-id username@remotehost</span>
</pre></div>
<p class="para">
     Finally, double check the permissions on the <span class="file filename">authorized_keys</span> file, only the authenticated user should have read and write permissions.
     If the permissions are not correct change them by:
     </p>
<div class="screen"><pre class="contents "><span class="cmd command">chmod 600 .ssh/authorized_keys</span>
</pre></div>
<p class="para">
     You should now be able to SSH to the host without being prompted for a password.
     </p>
</div></div>
</div></div>
<div class="sect2 sect" id="openssh-references"><div class="inner">
<div class="hgroup"><h2 class="title">References</h2></div>
<div class="region"><div class="contents"><div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
          <p class="para">
          <a href="https://help.ubuntu.com/community/SSH" class="ulink" title="https://help.ubuntu.com/community/SSH">Ubuntu Wiki SSH</a> page.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          <a href="http://www.openssh.org/" class="ulink" title="http://www.openssh.org/">OpenSSH Website</a>
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          <a href="https://wiki.ubuntu.com/AdvancedOpenSSH" class="ulink" title="https://wiki.ubuntu.com/AdvancedOpenSSH">Advanced OpenSSH Wiki Page</a>
          </p>
        </li>
</ul></div></div></div>
</div></div>
</div>
<div class="links nextlinks">
<a class="nextlinks-prev" href="remote-administration.html" title="Remote Administration">Previous</a><a class="nextlinks-next" href="puppet.html" title="Puppet">Next</a>
</div>
<div class="clear"></div>
</div>
<div id="pagebottom"></div>
</div></div>
</div>
<div id="footer"><p>The material in this document is available under a free license, see <a href="https://help.ubuntu.com/legal.html">Legal</a> for details.<br>
          For information on contributing see the <a href="https://wiki.ubuntu.com/DocumentationTeam">Ubuntu Documentation Team wiki page</a>.
          To report errors in this serverguide documentation, <a href="https://bugs.launchpad.net/serverguide">file a bug report</a>.</p></div>
</div>
</body>
</html>
